The vulnerability in Open WebUI’s terminal WebSocket endpoint allows an account whose role is pending, such as a registered but unapproved user, to open an interactive terminal session. Because the endpoint fails to enforce the role check applied to HTTP terminal routes, the account‑approval boundary is bypassed. The affected route authenticates the first JWT message but does not gate access by role, resulting in unauthorized terminal access that could enable an attacker to execute arbitrary commands and exfiltrate data.

Affected versions of Open WebUI range from 0.8.8 through 0.10.x up to the unpatched 0.11.0 release. Administrators running these versions and configuring at least one terminal server with access grants that include pending accounts are at risk. The issue remains in all open-webui:open-webui deployments that have not applied the 0.11.0 fix.

The CVSS base score of 6.3 indicates a moderate severity, and the vulnerability is not listed in CISA KEV, with no EPSS data available. Exploitation requires an account with a pending status and a configured terminal server; the attacker can independently create such an account or employ social engineering to gain one. Once the conditions are met, the attacker can initiate a WebSocket connection and obtain a terminal session, bypassing the intended approval process. The lack of a known public exploit at this time suggests the risk is contingent on the attackers’ ability to create or obtain pending credentials.